[llvm] r324610 - [ValueTracking] don't crash when assumptions conflict (PR36270)

[Sanjay Patel via llvm-commits]

Author: spatel
Date: Thu Feb  8 06:52:40 2018
New Revision: 324610

URL: http://llvm.org/viewvc/llvm-project?rev=324610&view=rev
Log:
[ValueTracking] don't crash when assumptions conflict (PR36270)

The last assume in the test says that %B12 is 0. 
The first assume says that %and1 is less than %B12. 
Therefore, %and1 is unsigned less than 0...does not compute.

That means this line:
Known.Zero.setHighBits(RHSKnown.countMinLeadingZeros() + 1);
...tries to set more bits than exist.

Differential Revision: https://reviews.llvm.org/D43052


Modified:
    llvm/trunk/lib/Analysis/ValueTracking.cpp
    llvm/trunk/test/Transforms/InstSimplify/assume.ll

Modified: llvm/trunk/lib/Analysis/ValueTracking.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Analysis/ValueTracking.cpp?rev=324610&r1=324609&r2=324610&view=diff
==============================================================================
--- llvm/trunk/lib/Analysis/ValueTracking.cpp (original)
+++ llvm/trunk/lib/Analysis/ValueTracking.cpp Thu Feb  8 06:52:40 2018
@@ -816,6 +816,14 @@ static void computeKnownBitsFromAssume(c
       KnownBits RHSKnown(BitWidth);
       computeKnownBits(A, RHSKnown, Depth+1, Query(Q, I));
 
+      // If the RHS is known zero, then this assumption must be wrong (nothing
+      // is unsigned less than zero). Signal a conflict and get out of here.
+      if (RHSKnown.isZero()) {
+        Known.Zero.setAllBits();
+        Known.One.setAllBits();
+        break;
+      }
+
       // Whatever high bits in c are zero are known to be zero (if c is a power
       // of 2, then one more).
       if (isKnownToBeAPowerOfTwo(A, false, Depth + 1, Query(Q, I)))

Modified: llvm/trunk/test/Transforms/InstSimplify/assume.ll
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/Transforms/InstSimplify/assume.ll?rev=324610&r1=324609&r2=324610&view=diff
==============================================================================
--- llvm/trunk/test/Transforms/InstSimplify/assume.ll (original)
+++ llvm/trunk/test/Transforms/InstSimplify/assume.ll Thu Feb  8 06:52:40 2018
@@ -5,6 +5,7 @@
 
 ; CHECK: remark: /tmp/s.c:1:13: Detected conflicting code assumptions.
 ; CHECK: remark: /tmp/s.c:4:10: Detected conflicting code assumptions.
+; CHECK: remark: /tmp/s.c:5:50: Detected conflicting code assumptions.
 
 define void @test1() {
 ; CHECK-LABEL: @test1(
@@ -50,6 +51,24 @@ define i8 @conflicting_assumptions(i8 %x
   ret i8 %add
 }
 
+; Another case of conflicting assumptions. This would crash because we'd
+; try to set more known bits than existed in the known bits struct.
+
+define void @PR36270(i32 %b) !dbg !13 {
+; CHECK-LABEL: @PR36270(
+; CHECK-NEXT:    tail call void @llvm.assume(i1 false)
+; CHECK-NEXT:    unreachable
+;
+  %B7 = xor i32 -1, 2147483647
+  %and1 = and i32 %b, 3
+  %B12 = lshr i32 %B7, %and1, !dbg !14
+  %C1 = icmp ult i32 %and1, %B12
+  tail call void @llvm.assume(i1 %C1)
+  %cmp2 = icmp eq i32 0, %B12
+  tail call void @llvm.assume(i1 %cmp2)
+  unreachable
+}
+
 declare void @llvm.assume(i1) nounwind
 
 !llvm.dbg.cu = !{!0}
@@ -69,4 +88,6 @@ declare void @llvm.assume(i1) nounwind
 !10 = distinct !DISubprogram(name: "bar", scope: !1, file: !1, line: 3, type: !8, isLocal: false, isDefinition: true, scopeLine: 3, isOptimized: true, unit: !0, variables: !2)
 !11 = !DILocation(line: 4, column: 10, scope: !10)
 !12 = !DILocation(line: 4, column: 3, scope: !10)
+!13 = distinct !DISubprogram(name: "PR36270", scope: !1, file: !1, line: 3, type: !8, isLocal: false, isDefinition: true, scopeLine: 3, isOptimized: true, unit: !0, variables: !2)
+!14 = !DILocation(line: 5, column: 50, scope: !13)